Analysis
-
max time kernel
2378046s -
max time network
145s -
platform
android_x64 -
resource
android-x64-20231215-en -
resource tags
-
submitted
20-12-2023 06:43
General
-
Target
8c8806de862133ede2eddd2a82751af95eb39e0dd732478cc70baa5bb2d6ebdf.apk
-
Size
2.1MB
-
MD5
c4a118a1dd6dd7182329449cf4faa60a
-
SHA1
a36de5592e735ee578c24aedd0883e72c8eb95a5
-
SHA256
8c8806de862133ede2eddd2a82751af95eb39e0dd732478cc70baa5bb2d6ebdf
-
SHA512
77ade4851913d397ea238f60e42c7cdcbcadfc44ad67c6bdb805bf83e2b6146785a368f79ed8226489d86d0074fc5bd36c769f6ab2c87a21ec28a77a9f888ef4
-
SSDEEP
49152:LYYyEq32TvbIQ+cXIfivCm1Qh2PwYQyh4FYl0zfHFmErH8e/G:LYgTvn0tyh4Q6NS
Malware Config
Extracted
alienbot
http://oylebibokabattimben.com
Signatures
-
Alienbot
Alienbot is a fork of Cerberus banker first seen in January 2020.
-
Cerberus
An Android banker that is being rented to actors beginning in 2019.
-
Cerberus payload 1 IoCs
-
Makes use of the framework's Accessibility service 2 IoCs
Retrieves information displayed on the phone screen using AccessibilityService.
-
Removes its main activity from the application launcher 7 IoCs
-
Loads dropped Dex/Jar 2 IoCs
Runs executable file dropped to the device during analysis.
-
Acquires the wake lock 1 IoCs
Processes
-
kaufcdbonmliysryrdoau.aerajrgbecibrzrydm.pyprsxmsyakxhhkug1⤵
- Makes use of the framework's Accessibility service
- Removes its main activity from the application launcher
- Loads dropped Dex/Jar
- Acquires the wake lock
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
436B
MD5f16be49a49653667da4986dc81c05712
SHA1953dc242141f9bd28ca6e37f0f4b58eea323deb1
SHA2568cc8aaaead29aebf7538d70bb780e25131805d20fa391995e87964f989eb452d
SHA512a7bf36d22d0cb50cef93989209755538440fadf21d515c89991561e507396f66ae1d75d34654f08fb8383859f96489d0c82a081f05d2787f1281a13d8679faa4
-
Filesize
700KB
MD5a0f1409eed47d0ae2644e2958bf604cf
SHA17de1e6a3b6a612a9c5d24f9261267d1c508e7d21
SHA256c1f32bb07764fd3d73bb0334ea9980d492143e6a5ffeec3c49a89928a9bf1f5e
SHA5122cc7067f7bc775ad8cec37395b8aea143bd4df8aca3281878ccdb1ac2fc6795e963e8a25a90be5158e375bd777d505e8bddb4a971423cb060f6ad2b13bb47bc0
-
Filesize
700KB
MD52598f9354762678916739e421d0446f4
SHA1af432cb2704286b815938d4c9f43611b24711879
SHA256c6b8cd75dd214186b8782a2c7a7f382913b40211258a0b9cc2932f5a69146491
SHA51218974a08e22cc356eb6ce3dfb8a847849dfb3caaf80ee941f9c7a70a90ff18510ebf45167c5b3c1584197f6e6d5e9cf40feaec5ba0db5ee6072a002439ede93a